CVE-2026-88924
published 2026-09-10CVE-2026-88924: A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the…
PriorityP338high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.17%
6.3th percentile
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnome | gvfs | — | — |
| gnome | gvfs | >= 1.48.1 < 1.62.0 | 1.62.0 |
| gnome | gvfs | >= 1.48.1 < 1.60.3 | 1.60.3 |
| gnome | gvfs | >= 1.48.1 < 1.58.5 | 1.58.5 |
| ubuntu | gvfs | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu8.8HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GVfs vulnerabilities
vendor_ubuntu·2026-09-30·CVSS 8.8
CVE-2026-84268 [HIGH] GVfs vulnerabilities
Title: GVfs vulnerabilities
Summary: Several security issues were fixed in GVfs.
Keith Linneman discovered that GVfs did not properly validate data
received from SFTP servers. An attacker could possibly use this issue to
cause a heap buffer overflow, resulting in arbitrary code execution or a
denial of service. (CVE-2026-84268)
It was discovered that GVfs incorrectly handled file ownership when
creating private D-Bus sockets in the admin backend. A local attacker
could possibly use this issue to change the ownership of arbitrary
system files, resulting in privilege escalation to root. This issue only
affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-88924)
Instructions: After a standard system update you need to restart your session to make
all the necessary
Red Hat
gvfs: gvfs-admin socket ownership race permits local root
vendor_redhat·2026-09-09·CVSS 7.0
CVE-2026-88924 [HIGH] CWE-367 gvfs: gvfs-admin socket ownership race permits local root
gvfs: gvfs-admin socket ownership race permits local root
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.
Statement: To exploit this issu
GHSA
A flaw was found in the admin backend of gvfs.
ghsa_unreviewed·2026-09-10
CVE-2026-88924 [HIGH] CWE-367 A flaw was found in the admin backend of gvfs.
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leading to a full local privilege escalation to root.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-88924 gvfs: gvfs-admin socket ownership race permits local root
bugzilla·2026-09-10·CVSS 7.0
CVE-2026-88924 [HIGH] CVE-2026-88924 gvfs: gvfs-admin socket ownership race permits local root
CVE-2026-88924 gvfs: gvfs-admin socket ownership race permits local root
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition by using inotify to detect the socket creation, and then atomically exchanging the socket pathname with a symbolic link pointing to an arbitrary root-owned file (such as /etc/pam.d/su). The daemon subsequently follows the symlink and changes the ownership of the targeted root-owned file to the attacker's user ID. This allows an authenticated local attacker to modify critical system files, leadi
Bugzilla
CVE-2026-88924 gvfs: gvfs-admin socket ownership race permits local root [fedora-all]
bugzilla·2026-09-10·CVSS 7.0
CVE-2026-88924 [HIGH] CVE-2026-88924 gvfs: gvfs-admin socket ownership race permits local root [fedora-all]
CVE-2026-88924 gvfs: gvfs-admin socket ownership race permits local root [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition by using inotify to detect the socket creation, and then atomically exchanging the socket pathname with a symbolic link pointing to an arbitrary root-owned fil
2026-09-10
Published